wok-current view linux/stuff/linux-usbip-fix-format-overflow-gcc8.patch @ rev 25698
Fix ntfs-3g receipt
| author | Stanislas Leduc <shann@slitaz.org> |
|---|---|
| date | Tue Apr 16 19:01:01 2024 +0000 (6 months ago) |
| parents | |
| children |
line source
1 Upstream commit e5dfa3f902b9 ("usbip: Fix potential format overflow in
2 userspace tools")
5 The usbip userspace tools call sprintf()/snprintf() and don't check for
6 the return value which can lead the paths to overflow, truncating the
7 final file in the path.
9 More urgently, GCC 7 now warns that these aren't checked with
10 -Wformat-overflow, and with -Werror enabled in configure.ac, that makes
11 these tools unbuildable.
13 This patch fixes these problems by replacing sprintf() with snprintf() in
14 one place and adding checks for the return value of snprintf().
16 Reviewed-by: Peter Senna Tschudin <peter.se...@gmail.com>
17 Signed-off-by: Jonathan Dieter <jdie...@lesbg.com>
18 Acked-by: Shuah Khan <shua...@osg.samsung.com>
19 Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
20 Signed-off-by: Shuah Khan <shua...@osg.samsung.com>
22 diff --git a/tools/usb/usbip/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c
23 index ac73710..01dd4b2 100644
24 --- a/drivers/staging/usbip/userspace/libsrc/usbip_common.c
25 +++ b/drivers/staging/usbip/userspace/libsrc/usbip_common.c
26 @@ -215,9 +215,16 @@
27 struct usbip_usb_interface *uinf)
28 {
29 char busid[SYSFS_BUS_ID_SIZE];
30 + int size;
31 struct udev_device *sif;
33 - sprintf(busid, "%s:%d.%d", udev->busid, udev->bConfigurationValue, i);
34 + size = snprintf(busid, sizeof(busid), "%s:%d.%d",
35 + udev->busid, udev->bConfigurationValue, i);
36 + if (size < 0 || (unsigned int)size >= sizeof(busid)) {
37 + err("busid length %i >= %lu or < 0", size,
38 + (unsigned long)sizeof(busid));
39 + return -1;
40 + }
42 sif = udev_device_new_from_subsystem_sysname(udev_context, "usb", busid);
43 if (!sif) {
44 diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
45 b/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
46 index 9d415228883d..c10379439668 100644
47 --- a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
48 +++ b/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
49 @@ -39,13 +39,19 @@
50 static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
51 {
52 char status_attr_path[SYSFS_PATH_MAX];
53 + int size;
54 int fd;
55 int length;
56 char status;
57 int value = 0;
59 - snprintf(status_attr_path, SYSFS_PATH_MAX, "%s/usbip_status",
60 - udev->path);
61 + size = snprintf(status_attr_path, sizeof(status_attr_path),
62 + "%s/usbip_status", udev->path);
63 + if (size < 0 || (unsigned int)size >= sizeof(status_attr_path)) {
64 + err("usbip_status path length %i >= %lu or < 0", size,
65 + (unsigned long)sizeof(status_attr_path));
66 + return -1;
67 + }
69 if ((fd = open(status_attr_path, O_RDONLY)) < 0) {
70 err("error opening attribute %s", status_attr_path);
71 @@ -224,6 +230,7 @@
72 {
73 char attr_name[] = "usbip_sockfd";
74 char sockfd_attr_path[SYSFS_PATH_MAX];
75 + int size;
76 char sockfd_buff[30];
77 int ret;
79 @@ -244,10 +251,20 @@
80 }
82 /* only the first interface is true */
83 - snprintf(sockfd_attr_path, sizeof(sockfd_attr_path), "%s/%s",
84 + size = snprintf(sockfd_attr_path, sizeof(sockfd_attr_path), "%s/%s",
85 edev->udev.path, attr_name);
86 + if (size < 0 || (unsigned int)size >= sizeof(sockfd_attr_path)) {
87 + err("exported device path length %i >= %lu or < 0", size,
88 + (unsigned long)sizeof(sockfd_attr_path));
89 + return -1;
90 + }
92 - snprintf(sockfd_buff, sizeof(sockfd_buff), "%d\n", sockfd);
93 + size = snprintf(sockfd_buff, sizeof(sockfd_buff), "%d\n", sockfd);
94 + if (size < 0 || (unsigned int)size >= sizeof(sockfd_buff)) {
95 + err("socket length %i >= %lu or < 0", size,
96 + (unsigned long)sizeof(sockfd_buff));
97 + return -1;
98 + }
100 ret = write_sysfs_attribute(sockfd_attr_path, sockfd_buff,
101 strlen(sockfd_buff));
102 --
103 2.14.1